Malware detection involves both static and dynamic analysis techniques [1]}. Classic Static analysis approaches primarily involved using a tool such as Yara [2]} to generate specific rules or patterns for identifying malicious files. However, static signatures fail to keep pace with the rapidly evolving space of deployed malware variants [3]} and can take days of manual effort [4]}, [5]}. Malware detectors rooted in dynamic analysis [6]} execute a binary in a sandbox to observe its behavior while restricting potential damage. Dynamic approaches step past the limitations of static analyses, the required analysis can be computationally expensive because each file often must be executed multiple times to elicit harmful behavior. Worse, some malicious binaries embed checks to detect whether they are running a virtual (sandbox) environment based on VM properties such as the amount of available DRAM, the number of cores, the list of installed applications/tools, and even the temperature of the CPU [1]} and dynamically alter their behavior to evade detection.
